Archive for September, 2008

The lock on my door is a Yale Model AG34

door lockNo, I don’t suppose that is the first thing you are going to tell a perfect stranger now is it? How about someone who has just called to your door? More unlikely still.

The Rant:
Which is why it really annoys me that some web applications insist on vanity tags displaying to the world what software system you are using, and worse still, sometimes it shows what version you are using!

Just what is required to execute a zero-day attack on your poor little website. Or indeed make it far too easy for evil minded people to find sites running out of date software.

Is it on your site?
Examine the source code of your web page. It will be between the “head” tags at the top of the page. Take for example the screenshot of the html code on a blog I visited the other day. You can clearly see from the generator meta tag that not only is the blog powered by WordPress, but it is running version 2.5.1. In this example, the blogger is probably fine. There are a couple of security fixes released since WordPress 2.5.1 was out in July, but none that I would rate as vital. But is it really a good idea to let the world know:
a) what web application you are running?
b) what exact version you have installed?
wordpress generator meta

The cure
Now, I was going to go into a big rant about just how pointless I thought the generator meta tag was anyway, but I have to decided to bite my tongue and concentrate on the real evil: including the version number.

This is just plain old bad idea. I was really annoyed to see it creep back into the WordPress blogs I manage recently as the location has been switched from the wordpress header template file to the WordPress internals (from WordPress 2.5 on). So even if you thought you had removed it, if you upgraded to 2.5 or later, it might be back in there again!

There is a relatively easy way to remove it again however, and this should be permanent unless they change this again in a future major version release.
Add the following line to the functions.php file of your WordPress theme:
remove_action('wp_head', 'wp_generator');
(within the php code tags)

For other web applications, you may need to check the documentation or search the support forums for answers on how to remove the generator tag.

Comments (1)

Thank you Susan

For the past month now I have been plagued by a minor issue that has been grating at me to the point where it has become really irritating.

Every time I use a file open dialogue box (attaching a file, opening a file) on my Windows XP laptop, the files and folders are ordered by the last modified date. This is intensely annoying if it happens
every single time you go to open a file or folder
! My only solution in folders with large numbers of files has been to right-click and re-order by name, but this ordering is lost the next time, and it defaults back to last modified.

I finally found the solution in a Logical Tips article written by Susan Daffron, who also had to endure lots of aggravation before finding the cure!

What did we do wrong? Apparently we were holding down the control key when closing a Windows Explorer window….. Serves us right so.

Comments

CSS Validator: Servlet has thrown exception: javax.servlet.ServletException: Timed out

I admit, not the sexiest title you will come across.

I have been recently tweaking the design of my site. My first port of call, as it usually is when I need to iron out the kinks in a style sheet, is the W3C’s CSS Validation Service. I find that ensuring anything, be it html, xhtml or css is standards compliant, goes a good way to curing a number of cross browser issues, allowing you to concentrate on the stubborn ones that drive you scatty sometimes.

So off I go to validate my style sheets and um, nothing. Looks like the server is down, throwing the error I mentioned in the title.

No matter I thought, I will try another one. Put in “css validator” into your favourite search engine and you will get plenty of results. The problem it seems though, is that practically all of them use the W3C’s CSS Validator as a back-end. The same result comes back time after time:

Servlet has thrown exception:javax.servlet.ServletException: Timed out

I did find one site that has a non-W3C validator, but this is a shareware program which you must download and install. Hardly ideal and is most likely limited in functionality unless you cough up for the full version.

After about 48 hours I began to get suspicious of the fact that nobody else on the oul Interweb had reported a similar issue. Sure enough, after testing a couple of other sites, I found that the issue was specific to my own website.

On further testing, I found that a couple of other sites also had this issue. Specifically, WordPress sites with a plugin installed called Sezwho. Sezwho is a web service that adds additional functionality to WordPress comments, more on that in a separate article.

An undocumented “feature” is breaking the CSS Validator. Hopefully anyone else with a similar issue might find this useful. I will contact Sezwho to let them know of course.

Oh, and if you do want to validate your CSS, just deactivate the plugin, validate the css and reactivate the plugin.

Comments (5)